Octopus Server CVE-2026-91778

Exploitation requires a valid authenticated Octopus Server account holding at least some scoped permission set (PR:L per CVSS 4.0 vector). The vulnerability triggers during script execution on workers, so the attacker must be able to initiate or influence a script execution request within the Octopus Server API. The built-in worker must be enabled on the target Octopus Server instance for the highest-impact scenario; the advisory explicitly names it as a reachable target. The specific scoped permission types that trigger the authorization bypass are not detailed in the available public data - the vendor advisory at https://advisories.octopus.com/post/2026/sa2026-08 should clarify which permission combinations are vulnerable. Unauthenticated external attackers with no Octopus account cannot exploit this flaw. The attack requires no user interaction (UI:N) and no special network conditions beyond reaching the Octopus Server's API endpoint.

The vendor-assigned CVSS 4.0 score of 7.2 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N reflects network-accessible exploitation requiring only a low-privilege authenticated account, meaning any Octopus user with some scoped permissions is a candidate attacker - and even a mid-sized municipal IT team in legnica running Octopus for infrastructure automation should treat this as urgent, given how broadly scoped accounts are typically provisioned in collaborative DevOps workflows. No public exploit has been identified and the CVE is absent from CISA KEV, which moderates immediate exploitation likelihood. The vendor's CVSS 4.0 impact metrics rate VC:N (no confidentiality impact) alongside VI:H/VA:H, but this appears inconsistent with arbitrary script execution on the built-in worker: the Octopus Server process routinely holds deployment secrets, cloud provider credentials, and API tokens that in-process script execution could trivially read. This discrepancy between rated and realistic confidentiality impact should be independently validated by affected organizations. Overall, the combination of low attack complexity, low privilege requirement, and the sensitive execution context of the built-in worker makes this a higher real-world priority than the 7.2 score alone may suggest.

An attacker with a low-privilege Octopus Server account - for example, a contractor granted read-scoped access to a specific project - crafts a script execution request that the server's authorization check incorrectly allows to proceed. The script runs on the built-in worker within the Octopus Server process, granting the attacker access to environment variables, deployment secrets, cloud credentials, and internal network reachability held by the server. No public exploit code has been identified at time of analysis.